devel gained the workflow analysis change. This branch is tested once
more against it before it merges.

Add workflow and dependency analysis

The dashboard is an issue, and issues are disabled in this repository,
so Renovate could not create it. Pending updates show as pull requests.

Renovate proposes the version updates of this repository from now on.
It watches what Dependabot watched, looks once a week, takes a release
a week after it is published, opens one pull request for each kind of
dependency with at most two open, and rebases a pull request only when
it conflicts. A dashboard issue lists what is pending.

The Dependabot configuration is removed, which turns its version
updates off. Dependabot keeps its alerts and its security updates,
which are repository settings. Renovate does not open its own pull
requests for vulnerabilities, so one advisory does not get two fixes.

The configuration passes Renovate's validator and takes effect when
the Renovate app is installed on the repository.

The owner decided against running OpenSSF Scorecard here. The workflow
added by the commit before this one is removed; nothing else changes.

zizmor audits the workflows themselves for what makes a workflow
unsafe, and uploads what it finds to code scanning. Its first run here
found one thing, 11 times: a checkout that leaves the job's token in
the checked-out repository, where any later step can read it. No
workflow pushes or needs the token after the checkout, so every checkout
now sets persist-credentials to false, and zizmor reports nothing.

OpenSSF Scorecard grades how the repository is kept: branch protection,
pinned dependencies, token permissions and the like. It runs on the
default branch and weekly and uploads its findings to
code scanning.

Dependency Review fails a pull request that adds or changes a dependency
with a known vulnerability of high severity or worse. Dependabot watches
what is already there; this holds what comes in.

Every new action is pinned to a commit, each job names the permissions
it needs, and no new workflow has a default permission.

Two steps of the Windows build ran in the CMD shell, which zizmor cannot

read into; they run in PowerShell now, with the same commands and the

processor count taken from the environment.

Add composite property generators, single-trial replay and stable counterexample printing

Property tests could only generate one integer or Boolean. This adds the
composite strategies the documentation listed as missing, without changing
any Catch2 file or the existing Progmasoft API.

Generators:
- Tuple(generators...) draws components left to right and shrinks one
  component at a time, which is how a property receives several arguments.
- Vector(element, minimumSize, maximumSize) and Text(alphabet,
  minimumLength, maximumLength) share one ordered shrink: shortest allowed
  prefix, the two halves, single removals, then single element
  simplifications. A shrunk value never falls below its minimum, each step
  offers at most 256 candidates, and a size limit above 1,048,576 is
  rejected.
- Element(values) picks from a fixed list and shrinks toward earlier
  entries.

Runner:
- PropertyOptions::ReplayTrialSeed runs exactly one trial with a reported
  replay seed, including its shrinking, so a failure from a log can be
  reproduced without rerunning earlier trials. The report now ends with the
  line that names this option and the seed.
- Counterexamples of tuples, pairs and vectors are printed element by
  element instead of relying on Catch2's optional string makers, so the
  report does not depend on configuration macros or include order.

The headers still compile for clients built without language exceptions.
Thirteen new test cases cover bounds, determinism, shrink order, candidate
limits, minimized counterexamples, replay and invalid configurations, and
every build description (Bazel, CMake, Meson, Xmake, Premake) lists the new
headers and test file.

Preserve the existing exception-throwing and exception-catching API when language exceptions are enabled. Compile the property evaluator, shrinker and value formatter without try/catch for clients using -fno-exceptions, and fail loudly on invalid generator range or missing callbacks instead of requiring throw expressions in those translation units.

Export the new diagnostic helper through Bazel and Meson header installations. This changes neither the upstream Catch2 implementation nor its compiler flags.

Validation: Clang++ C++20 syntax checks passed for property generators with exceptions both disabled and enabled; changed headers were formatted and git diff --check passed. The consuming compiler's Linux/Windows/macOS CI will verify the integration.